Tag: extortion
-
Iran-linked ransomware operation targeted US healthcare provider
The Pay2Key group may have shifted its aims from extortion to destruction. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/iran-linked-ransomware-operation-targeted-us-healthcare-provider/815652/
-
Botnet operator behind $14 million in ransomware extortion payments gets 24 months behind bars
A Russian national has been sentenced to 24 months in prison after admitting he managed a botnet used to launch ransomware attacks against dozens of U.S. companies. The judge … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/25/russian-botnet-operator-sentenced-mario-kart-ransomware/
-
Trivy supply chain breach compromises over 1,000 SaaS environments, Lapsus$ joins the extortion wave
Tags: access, breach, business, ceo, control, credentials, extortion, github, incident response, Internet, malicious, mandiant, open-source, saas, software, supply-chain, theft, updateA pattern of persistent access: This is the second compromise affecting the Trivy ecosystem within roughly a month. Socket identified compromised Aqua Trivy VS Code extension releases on OpenVSX in late February, and now trivy-action, Trivy’s official GitHub Action for running scans in CI/CD workflows, has been abused through manipulated version tags to distribute malicious…
-
PyPI warns developers after LiteLLM malware found stealing cloud and CI/CD credentials
Tags: access, advisory, api, attack, cloud, container, credentials, data, exploit, extortion, github, group, infrastructure, malicious, malware, open-source, pypi, supply-chain, tactics, tool, vulnerabilityAn expanding supply-chain campaign: The LiteLLM incident has been confirmed to be a part of the rapidly unfolding TeamPCP supply chain campaign that first compromised Trivy.Trivy, developed by Aqua Security, is a widely used open-source vulnerability scanner designed to identify security issues in container images, file systems, and infrastructure-as-code (IaC) configurations. The ongoing attack, attributed…
-
Experts warn of a ‘loud and aggressive’ extortion wave following Trivy hack
Attackers compromised the open-source security tool and published malicious versions of the software. Mandiant warns the fallout could impact up to 10,000 downstream victims. First seen on cyberscoop.com Jump to article: cyberscoop.com/trivy-supply-chain-attack-aqua-downstream-extortion-fallout/
-
Russian initial access broker helped ransomware gangs extort millions, sentenced to 81 months
A Russian citizen, Aleksei Volkov, was sentenced to 81 months in prison for helping ransomware groups carry out attacks causing over $9 million in actual losses and over $24 … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/24/russian-initial-access-broker-sentenced-ransomware-attacks/
-
Infinite Campus warns of breach after ShinyHunters claims data theft
Infinite Campus, a widely used K-12 student information system, is warning customers of a data breach following an extortion attempt by a threat actor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/infinite-campus-warns-of-breach-after-shinyhunters-claims-data-theft/
-
US, allies move to dismantle four high-volume IoT botnets
The armies of hacked computers and internet of things gadgets powered disruption and extortion campaigns that sometimes cost victims tens of thousands of dollars. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/botnet-takedown-operation-us-canada-germany/815309/
-
Interlock Ransomware Targets Cisco Enterprise Firewalls
The ransomware gang, known for double-extortion attacks, had access to a critical Cisco firewall vulnerability weeks before it was publicly disclosed. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/interlock-ransomware-targets-cisco-enterprise-firewalls
-
Terminated contract led to $2.5 million cyber extortion scheme
A federal jury convicted Cameron Curry, 27, a Charlotte resident, of carrying out an extensive cyber extortion scheme targeting a Washington, D.C.-based international … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/20/charlotte-man-cyber-extortion-dc-tech-company/
-
Ex-data analyst stole company data in $2.5M extortion scheme
A North Carolina man was found guilty of extorting a D.C.-based technology company while still being employed as a data analyst contractor. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/data-analyst-found-guilty-of-extorting-brightly-software-of-25-million/
-
Google Warns Ransomware Groups Shift to Data Theft as Profits Decline
Google is warning that ransomware gangs are reinventing their business model as traditional encryption”‘for”‘ransom attacks become less profitable and data”‘theft extortion surges.”‹ Better cybersecurity controls, improved backup strategies, and stronger recovery capabilities mean more victims can restore their systems without paying, directly eroding criminal revenue. Public reporting also shows that both ransom payment rates and average demand…
-
Payload ransomware hits Windows and ESXi with Babuk-style encryption
Tags: cryptography, cyber, encryption, extortion, group, healthcare, ransomware, threat, vmware, windowsA new ransomware operation called Payload is rapidly emerging as a serious threat to both Windows and VMware ESXi environments, combining Babuk-style cryptography with aggressive anti-forensics and a working double-extortion model. The group claims to have been active since at least February 17, 2026. It is already hitting mid-to-large organizations across multiple sectors and countries. The hospital…
-
The ransomware economy is shifting toward straight-up data extortion
Google’s research report on ransomware activity last year underscores how cybercrime is evolving and clouding a collective understanding of its full impact and scale. First seen on cyberscoop.com Jump to article: cyberscoop.com/google-threat-intelligence-group-ransomware-report-2026/
-
Feds say another DigitalMint negotiator ran ransomware attacks and helped extort $75 million
Angelo Martino is accused of playing both sides, committing attacks and conducting ransomware negotiations on some of the same cases on behalf of his former employer. First seen on cyberscoop.com Jump to article: cyberscoop.com/digitalmint-ransomware-negotiator-arrest-angelo-martino-extortion/
-
Feds say another DigitalMint negotiator ran ransomware attacks and helped extort $75 million
Angelo Martino is accused of playing both sides, committing attacks and conducting ransomware negotiations on some of the same cases on behalf of his former employer. First seen on cyberscoop.com Jump to article: cyberscoop.com/digitalmint-ransomware-negotiator-arrest-angelo-martino-extortion/
-
Feds say another DigitalMint negotiator ran ransomware attacks and helped extort $75 million
Angelo Martino is accused of playing both sides, committing attacks and conducting ransomware negotiations on some of the same cases on behalf of his former employer. First seen on cyberscoop.com Jump to article: cyberscoop.com/digitalmint-ransomware-negotiator-arrest-angelo-martino-extortion/
-
Salesforce issues new security alert tied to third customer attack spree in six months
Researchers said the threat group behind the campaign is associated with ShinyHunters, an outfit that’s previously stolen data from Salesforce instances for extortion attempts. First seen on cyberscoop.com Jump to article: cyberscoop.com/salesforce-experience-cloud-customers-attacks/
-
Salesforce Sounds Alarm Over Fresh Data Extortion Campaign
CRM-Obsessed ShinyHunters Gang Exploits Misconfigured Customer Experience Portals. A prolific and noisy cybercrime gang with a penchant for stealing Salesforce customers’ data and holding it ransom is taking advantage of misconfigured guest accounts meant to provide public access to services meant to remain private, using a Google scanning tool to identify vulnerable accounts. First seen…
-
The people behind cyber extortion are often in their forties
Many cybercrime investigations end with arrests or indictments that reveal little about the people behind the operations. When authorities do disclose demographic details, the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/10/cyber-extortion-cybercrime-age-profile/
-
ISMG Security Report: Data-Extortion Ransomware Loses Steam
Revenue From Data-Extortion-Only Attacks Appear to Have Plummeted to Virtually Nil. While ransomware continues to disrupt businesses, thankfully some shakedown strategies are losing steam. The latest ISMG Security Report reviews how criminals have continued to refine the ransomware business model and why once-successful strategies for maximizing illicit profits now fall short. First seen on govinfosecurity.com…
-
ShinyHunters claims ongoing Salesforce Aura data theft attacks
Salesforce is warning customers that hackers are targeting websites with misconfigured Experience Cloud platforms that give guest users access to more data than intended. However, the ShinyHunters extortion gang claims to be actively exploiting a new bug to steal data from instances. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/shinyhunters-claims-ongoing-salesforce-aura-data-theft-attacks/
-
Tarnung als Taktik: Warum Ransomware-Angriffe raffinierter werden
Tags: access, ai, ciso, control, cyber, cyberattack, detection, encryption, endpoint, extortion, framework, intelligence, lockbit, mitre, openai, ransomware, RedTeam, service, software, strategy, threat, tool, vulnerabilityStatt eines kurzen, aber sehr schmerzhaften Stiches setzen Cyberkrimelle zunehmend darauf, sich in ihren Opfern festzubeißen und beständig auszusaugen.Ransomware-Angreifer ändern zunehmend ihre Taktik und setzen vermehrt auf unauffällige Infiltration. Dies liegt daran, dass die Drohung mit der Veröffentlichung sensibler Unternehmensdaten zum Hauptdruckmittel bei Erpressungen geworden ist.Der jährliche Red-Teaming-Bericht von Picus Security zeigt, dass Angreifer zunehmen…
-
Teenage hacker myth primed for a middle-age criminal makeover
Tags: access, breach, business, corporate, crypto, cyber, cybercrime, cybersecurity, data, detection, extortion, finance, group, hacker, hacking, infrastructure, jobs, malware, network, penetration-testing, programming, ransomware, service, skills, software, technology, threat, vulnerabilityCybercrime cartels: Dray Agha, senior security operations manager at managed detection and response services firm Huntress, said the analysis illustrates that the “Hollywood image of a teenage lone wolf hacking for bragging rights” is vastly outdated since the threat landscape is dominated by “highly organised, profit-driven syndicates.””While young people may still engage in digital vandalism…
-
ShinyHunters Claims Woflow Breach: What It Means for SaaS Supply Chain Security
Learn the security risks in SaaS supply chains and about ShinyHunters’ evolving extortion tactics behind the alleged Woflow breach. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/shinyhunters-claims-woflow-breach-what-it-means-for-saas-supply-chain-security/